WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS

2024-03-1100:00:00

Erwan LR (WPScan)

wpscan.com

woocommerce product filter

stored xss

admin

cross-site scripting

high privilege users

unfiltered html

multisite setup

vulnerability

security issue

woocommerce.

4.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.9%

JSON

Description The plugin does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PoC

As and admin, create a filter with the following payload as name: "> The XSS will be triggered in the Product Filters table (ie /wp-admin/admin.php?page=wpf_search)